[brettheap]

Lane: openreposhape-2 (openRepoShape-2)
Claim: #225 (comment)

What

leg_path_problem in scripts/shape_materialize.py is the one leg-path rule that scaffold-project.py and adopt-project.py both ask. It now asks one more question, last: does the project's own YAML reader give the value back from every template line the value is written into? When one line does not, the value is refused, in the form the rule's other sentences use. Over today's templates, which write the leg-path lines bare, the refusal reads:

REFUSED scaffold-bad-leg-path: --spec-path is '2026', which the project would not read back as text: the assembly root writes a leg path as `path: 2026` in `project.yaml` and as `submodule_path: 2026` in `contracts/code-pin.yaml` and `contracts/spec-pin.yaml`, and the project's own YAML reader reads that as the number 2026, so its first bootstrap would fail.

• Where it is refused. Every place the rule is already asked refuses the value before anything exists:

  • scaffold-project.py, under --dry-run alike, before a work directory or a remote is made.
  • adopt-project.py plan (adopt-bad-leg-path; no plan is written).
  • check (FINDING plan-bad-leg-path, for a plan that holds the value as quoted text).
  • execute (REFUSED plan-bad-leg-path, before any leg repository or the split branch exists).
  • setup-project.py, which passes the flag through to the scaffold.

• The reader decides, not a list of words. The rule calls repo_shape.parse_yaml, the reader every assembly root ships. Over a bare line, today it refuses:

  • null, Null, NULL and ~, read as no value.
  • true, True, TRUE, false, False and FALSE, read as booleans.
  • -?\d+ and -?\d+\.\d+ (2026, 007, 0, 1.5, 1.50), read as numbers. A leading - was already refused.

  It keeps yes, no, on, off, 0x1F, 0o17, 1e3, .inf, .nan, +1, .5 and 1_000, which this reader reads as text. It also keeps the issue's controls (spec, legs/spec, a..b, v1.5, 1.5.2) and null-spec, 2026-docs, legs/null, legs/2026, nUll and tRue. One test teaches the reader that yes is a boolean, and the rule then refuses yes without any edit of its own.

• The rule reads the templates themselves. It keeps no copy of a template line:

  • it finds every line of every YAML template under the shape's templates/ that holds {{SPEC_PATH}} or {{CODE_PATH}} (today project.yaml's two path: lines and each leg pin's submodule_path:);
  • it renders the value into each with render, under the file's name, as the scaffold and execute render it;
  • it reads each back with the reader, and its sentence quotes each line that misreads, as rendered.

  So once templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259 quotes those lines, every value checked_value admits is read back, and the rule refuses none of them with no edit of its own. Both tools render a project from that same templates/, and shape_materialize.py is in no copy list, so no project carries the rule and no digest pin moves.

• The rule is held to the templates. test_the_rule_agrees_with_every_template_line_that_holds_a_leg_path finds the lines on its own, and asserts that the rule refuses each tested value exactly when a line does not read it back.

• No spelling is offered, because nothing else names the same directory. _canonical_spelling also stops offering a spelling this rule would then refuse. On main, 2026/ was answered Write '2026'., and so were ./null, ~/ and True\. Over quoted lines, 2026/ is offered Write '2026'. again.

• The remediation (LEG_PATH_REMEDIATION) now names this rule beside the others: the reader "reads it back as the same text from every line the project writes it into (a bare line reads null, ~, true, False, 2026 and 1.5 as something else)".

• A template line the rule cannot read (one that is not a single key: value) is refused as template-leg-path-line, a defect in the shape's templates, rather than answered.

• No --help text changed. docs/cli.md is unchanged, and scripts/render-cli-reference.py --check passes.

Files, against main 7a8b981 (git diff --stat 7a8b981 c11804a):

• scripts/shape_materialize.py (+159 −6). It changes no import line: parse_yaml is the binding main already imports (see Merged main after 7a8b981).
• tests/test_leg_path_yaml_scalars.py (new, 229 tests).

Why

Reproduced on main 39ac59c with the lane's drivers (p31_dry.py, p31_adopt.py and p31_adopt_exec.py, pointed at this checkout):

• scaffold-project.py --dry-run accepts null, Null, NULL, ~, true, True, FALSE, 2026, 007, 1.5 and 1.50, for both --spec-path and --code-path.
• adopt-project.py plan and check pass null, NULL, ~, 2026, 007 and 1.5.
• adopt-project.py execute --spec-path 2026 ends adoption verified with path: 2026 on the split branch. The clone's bootstrap then exits 1: bootstrap FAILED: manifest (exit 1), pins (exit 1).
• On main 7a8b981 today, scaffold-project.py and adopt-project.py ask the project's YAML reader and validate-manifest.py about the manifest's values before anything exists, so --id null, --tracking-branch true and a blank --elected-by are refused (#258, #261) #314 (3ef059c) asks the project's validator about the manifest before anything exists, so the scaffold and plan now refuse these values too, as scaffold-manifest-invalid and adopt-manifest-invalid (manifest-leg-path: leg 'spec': path is None.). check still passes a plan that holds one as quoted text, and execute still ends adoption verified (see Tests).

Fix (a), and how it meets (b). Option (b), quoting the template lines, is issue #259. Lane 5's PR #395 (fix/template-quoted-placeholders, head d526f76) implements it. This PR does not quote them. Since the fix round below, its rule reads the template lines themselves, so it composes with (b) in either order. I checked what quoting the four leg-path lines would do:

• Digests.
  • project.yaml, contracts/spec-pin.yaml and contracts/code-pin.yaml are TEMPLATED files. They are rendered, and _materialize adds only the verbatim and from-shape copies to shape_files.
  • So they have no files: row in contracts/shape-pin.yaml. Quoting would move no per-file pin, and update-shape.py would report nothing: it reads only those rows and renders no templated file.
  • The only digest quoting moves is the shape tree_sha256 a new scaffold records, which every commit moves, this one included.
• Readers. Every reader of these files loads them with repo_shape's reader, so each would get a quoted path back as text:
  • validate-manifest.py's leg-path check (isinstance(path, str));
  • validate-pins.py's submodule_path != path;
  • bootstrap.py's str(leg.get("path") or "");
  • shape-doctor.py's str(leg.get("path") or role);
  • bump-leg.py's checked_value(..., str(leg.get("path") or "")), whose rewrite_pin rewrites only the commit: and tree_sha256: lines.

So (b) is not wrong. This PR does not take it as well:

• Only the scaffold (scaffold-project.py:1464 at c11804a) and adopt execute (adopt-project.py:5377) fill SPEC_PATH and CODE_PATH, and both ask this rule before anything exists (scaffold-project.py:1368; in adopt-project.py, :1768 for plan, :2415 for check's findings and :4476 for execute). With (a), no value either tool writes there can be read back as anything else.
• Quoting would change the rendered bytes of every new project's manifest and leg pins (path: "spec") for values that can no longer reach them.
• adopt-project.py plan writes null, true and other YAML keywords unquoted, so plan --spec-path null silently mounts the leg at the default spec #181 deliberately leaves template quoting to a follow-up, because the same templates serve both tools. That follow-up is templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259. See Composes with for the sequencing.
• The refused values are implausible directory names (the issue rates this P3).

Tests

tests/test_leg_path_yaml_scalars.py (new): 229 tests.

The rule reads the templates, so the file asks it three things. It holds on either side of #259.

• Its sentences, over a COPY of the templates whose leg-path lines are all bare (the bare_lines fixture), whatever the real ones write:

  • the rule's exact sentence for 15 values, each asked as --spec-path, legs.spec_path and legs.code_path;
  • the rule follows the reader when the reader learns a word;
  • no misread spelling is offered (5 cases).

• Its silence, over a copy whose leg-path lines are all quoted, as templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259 writes them (quoted_lines):

  • none of the 15 values is refused, for either leg, from a flag or a plan;
  • 2026/ and ./null are offered 2026 and null, and legs/../True is still offered nothing.

• Every line is asked. With project.yaml quoted and the pins bare, the sentence names the pins' submodule_path: 2026 alone.

• A template line that is not one key: value is refused as template-leg-path-line.

• Over the REAL templates:

  • 24 values the reader keeps as text stay paths;
  • the guard: the rule agrees with every template line that holds a leg path, which the test finds on its own, for all 39 values; a further test checks that the search found project.yaml and both leg pins;
  • legs\2026 is still offered legs/2026, and the remediation names the rule.

• End to end, over the real templates. The refusal rows are the values the real lines misread (all 15 today), and the values they read back join the acceptance rows (none today):

  • scaffold --dry-run refuses each misread value for --spec-path (15) and --code-path (6) with nothing created, names both legs in one refusal, and still accepts the 24 kept values;
  • the issue's own real scaffold (--spec-path 2026) is refused with no remote and no work directory;
  • a real scaffold at --spec-path 2026-docs --code-path v1.5, cloned recursively: the manifest and both pins read the paths as text, and bootstrap ok;
  • adopt plan refuses each (15, and 6 for --code-path) and writes no plan;
  • check reports each when a plan holds it as quoted text, and still passes 7 lookalikes;
  • execute refuses the issue's 2026 plan before any leg or split branch exists.

  Over templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259's quoted lines, the five refusal functions have no row and the three single-value tests skip (8 skipped). The 15 values are asked to be accepted instead: by the dry-run scaffold (15) and by check (15).

The new file against main 7a8b981's code: 128 failed, 101 passed, the count it gave against ab623dd. Every failure is the issue's reason, or a later round's. Since #314 (3ef059c), main refuses some of the values itself, in the validator's words, so 44 end-to-end rows now fail on the refusal's code and sentence rather than on exit 0:

failures	what main does
46	the rule returns None: 45 sentence rows (assert None == <sentence>), and the row that teaches the reader yes
23	scaffold --dry-run (15 for --spec-path, 6 for --code-path, 1 naming both legs) and the issue's real scaffold exit 2, but as REFUSED scaffold-manifest-invalid: ... manifest-leg-path: leg 'spec': path is None., in #314's words and not this sentence
21	plan (15, and 6 for --code-path) refuses as adopt-manifest-invalid, in the same words
15	check exits 0 (plan ok) on a plan holding the value as quoted text
1	execute exits 0 with adoption verified on the issue's plan
15	the rule accepts a value every real template line reads back as another type
4	offers Write '2026'., 'null', '~', 'True'
1	the remediation lacks the rule
1	a template line it cannot read raises nothing
1	the sentence for a pin-only misread

The 101 that pass are the controls, plus the 18 quoted-copy rows: main's rule refuses nothing at all.

The new file against b2b42f8's code: 125 failed, 104 passed. Each test this round adds fails for its reason:

• the quoted copy, 15 rows: b2b42f8's rule refuses 2026 over path: "2026" with "hold a leg path unquoted";
• the pin-only sentence: the old sentence;
• the unreadable line: DID NOT RAISE;
• the offers, 2 rows: no Write '2026'. or Write 'null'..

The other 106 are the rows that compare the reworded sentence or remediation.

A mutant that asks one hard-coded bare line again (for tree, file, line in (("assembly-root", "project.yaml", "path: {{SPEC_PATH}}"),): in _misread_reason) gives 124 failed, 105 passed at 3410be7. All 15 quoted-copy rows are among them. On the merge with #259's 233dc71, the same mutant gives 122 failed, 200 passed, 8 skipped over this file and test_template_text_placeholders.py: the 15 guard rows and the 15 quoted-copy rows, 30 acceptance rows, and 12 of #259's own end-to-end rows (6 scaffold, 6 adoption), among others. So the tests hold the rule's silence over #259's lines, in both files.

Targeted run at 3410be7 (fix round 266's record): 1633 passed, 1 skipped, 0 failed (group A 810 passed, group B 823 passed and 1 skipped; 1634 tests in the 21 files below), with git-filter-repo 2.47.0 on PATH. The skip is test_plan_on_medxehr_matches_the_rulings, which needs SHAPE_MEDXEHR_CLONE. scripts/render-cli-reference.py --check passes.

file	tests
test_leg_path_yaml_scalars.py	229
test_scaffold_leg_paths.py	27
test_scaffold_pin_and_reuse.py	20
test_scaffold_e2e.py	44
test_scaffold_leg_path_collisions.py	104
test_setup_project_py.py	84
test_cli_reference.py	13
test_windows_paths.py	38
test_repo_hygiene.py	50
test_scaffold_referent_chain_links.py	44
test_template_quoted_values.py	67
test_yaml_flow_quotes.py	17
test_yaml_quote_boundaries.py	73
test_adopt_leg_paths.py	349
test_adopt_leg_path_collisions.py	95
test_adopt_plan.py	57 (1 skipped)
test_adopt_plan_escapes.py	59
test_adopt_execute_refusals.py	37
test_adopt_verify.py	16
test_shape_doctor.py	208
test_git_output_decoding.py	3

The targeted run at this head, c11804a, is under Merged main after 7a8b981.

Composes with

At this head, c11804a. git merge-tree --write-tree <head> c11804a was run over every origin head that is in neither main 7a8b981 nor this branch: 79 heads, from the refs the lane fetched at 23:35Z.

• 55 give rc 0. They include:
  • templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259's PR templates: project.yaml, the leg pins and family.yaml quote their text placeholders, so --id 007, --tracking-branch 2026, --spec-path true or --org null read back as typed, and family.py add quotes a member id alike (#259) #395, fix/template-quoted-placeholders d526f76;
  • adopt-project.py plan writes null, true and other YAML keywords unquoted, so plan --spec-path null silently mounts the leg at the default spec #181's fix/adopt-plan-quote-yaml-keywords c87c45f (no PR);
  • adopt-project.py: check finds, and execute refuses before any leg exists, a plan follow_ups: that is not a list of text and an elected_on: that election_date does not read, with or without a reference:, so follow_ups: 5 is no longer a traceback and elected_on: someday is no longer refused under a flag neither command takes (#293, #294) #356 fix/adopt-check-hand-edited-plan 55d88e6, shape-doctor.py: the manifest kinds row puts back a shape or leg pin under contracts/ that does not load with the git command pin_restore picks from its own state, shows a copy the shape pin has a row for or a neutral product pin with a read-only git diff, and leaves any other file to a person whatever it is called, so its NEXT no longer tells the reader to delete the pin (#291) #358 fix/doctor-manifest-kinds-unreadable-pin c637722 and shape-doctor.py: a conflicted shape pin's NEXT takes the pin alone and gives a copy conflicted beside it to a person to merge by hand, so pasting it no longer drops an edit kept with --accept-local and then says COMPLIANT (#485) #496 fix/485-doctor-conflicted-pin-and-copy 565f920.
• 24 give rc 1, and each of them conflicts with main by itself, in exactly the same files. None of those files is one of this PR's two.
• fix/adopt-record-submodule-placement, which conflicted with this branch in the import list at 3410be7, landed as 7a8b981 (adopt-project.py: execute records in project.yaml which leg the plan gave each submodule a leg keeps, and shape-doctor.py holds the submodule to that row, so one in the other leg is MISPLACED and a real adoption's placement reads ok (#189) #394). Merged main after 7a8b981, below, says how that list was resolved.

With #259 (PR #395) at d526f76: 874 passed, 8 skipped, and 1 failed that is #395's with main, not this PR's. The scratch merge c11804a + d526f76 (merge-tree rc 0) was run over this PR's file, test_template_text_placeholders.py, test_scaffold_manifest_values.py, test_adopt_manifest_values.py, test_manifest_validator.py, test_pin_validator.py, test_adopt_submodules.py, test_scaffold_leg_paths.py, test_scaffold_e2e.py and test_reference_default.py.

• Over the quoted lines the rule refuses none of the values they read back. The 8 skips are this file's refusal rows, which have nothing to refuse there.
• The failure is test_scaffold_manifest_values.py::test_a_value_git_refuses_as_a_branch_is_refused_before_anything_is_made[branch-tilde], an XPASS(strict). templates: project.yaml, the leg pins and family.yaml quote their text placeholders, so --id 007, --tracking-branch 2026, --spec-path true or --org null read back as typed, and family.py add quotes a member id alike (#259) #395's xfail mark for scaffold-project.py holds --tracking-branch only to checked_value's alphabet, so a name git refuses as a branch (~, a..b, x.lock, a trailing /) passes --dry-run and, against GitHub, dies at the first git init -b after gh repo create has made all three repositories #283 says to take it off once scaffold-project.py and family.py: --tracking-branch is asked of git check-ref-format --branch before anything exists, so ~, a..b, x.lock and a/ are refused under --dry-run and no longer die at the first git init -b after gh repo create has made the repositories (#283) #355 lands, and scaffold-project.py and family.py: --tracking-branch is asked of git check-ref-format --branch before anything exists, so ~, a..b, x.lock and a/ are refused under --dry-run and no longer die at the first git init -b after gh repo create has made the repositories (#283) #355 is on main (6c2a371). Main 7a8b981 + d526f76, without this PR, fails the same test the same way. templates: project.yaml, the leg pins and family.yaml quote their text placeholders, so --id 007, --tracking-branch 2026, --spec-path true or --org null read back as typed, and family.py add quotes a member id alike (#259) #395 owes that one change, whichever of the two lands first.

Earlier, at 3410be7 (fix round 266's record). git merge-tree --write-tree 3410be7 <head> over the 60 origin heads not in main at 16:40Z: 58 gave rc 0, among them main 92e29d9, #395 at 3894aa8 (and 233dc71), #181's d38e143 and fix/adopt-pin-writes-pin-file 7a94b6b. fix/adopt-record-submodule-placement 48bdbf9 (the import list) and #358's 2745890 (shape-doctor.py, which conflicted with main by itself) gave rc 1.

With #259 at 3410be7 (PR #395 at 3894aa8, and 233dc71 before it): 0 failed, in either order. On the scratch merges 3410be7 + 233dc71 and 3410be7 + 3894aa8, the rule refuses none of the 15 values, and 2026/ is offered Write '2026'.. #259's own tests pass, its 12 scaffold and adoption end-to-end rows among them.

files on the merge	3410be7 + 233dc71	3410be7 + 3894aa8
test_leg_path_yaml_scalars.py (207 there), test_template_text_placeholders.py (123; 130 at 3894aa8), test_scaffold_e2e.py (44), test_scaffold_leg_path_collisions.py (104), test_manifest_validator.py (39), test_pin_validator.py (19)	528 passed, 8 skipped	535 passed, 8 skipped
test_shape_doctor.py (245), test_adopt_leg_paths.py (349), test_adopt_leg_path_collisions.py (95), test_adopt_plan.py (57), test_adopt_plan_escapes.py (59), test_adopt_execute_refusals.py (37), test_adopt_verify.py (16)	854 passed, 4 skipped	854 passed, 4 skipped
lane 5's request of 15:07Z: test_leg_path_yaml_scalars.py	199 passed, 8 skipped	199 passed, 8 skipped
lane 5's request: test_template_text_placeholders.py -k "a_scaffold_reads_back or an_adoption_reads_back"	12 passed (111 deselected)	12 passed (118 deselected)

The 8 skips are this file's end-to-end refusals, which have nothing to refuse over quoted lines. The 4 in the second row are 3 Windows-only PowerShell rows of test_shape_doctor.py and the MedxEHR plan test. For comparison, b2b42f8 + 233dc71 gave 27 failed, 305 passed on this file and test_template_text_placeholders.py, lane 5's figure.

With main 92e29d9: 0 failed. git merge-tree --write-tree 3410be7 92e29d9 is rc 0 (tree e8db6da). On that merge, test_leg_path_yaml_scalars.py (229), test_shape_doctor.py (258), test_scaffold_leg_path_collisions.py (104), test_adopt_leg_paths.py (349), test_adopt_leg_path_collisions.py (95) and test_adopt_plan_escapes.py (59) give 1091 passed, 3 skipped (the Windows-only PowerShell rows). The new file's count against main's code is measured again at 7a8b981, under Tests.

The rest of this section is fix round 1's record, measured at b2b42f8 and earlier.

(This table was measured at 00:37Z. The re-verification at 11:5xZ found the head clean against main 346079d, #181, #314, #316 and this lane's other heads, with fix/adopt-record-submodule-placement 3e86200 conflicting in the same import list and resolving as the union of names (393 passed). See review266-aa2be9a/reverify-1.md.)

Main was merged into this branch at b2b42f8 (main 6d8d88b). The reason: #284 (fix/yaml-quote-boundaries) landed as b30595c and added double_quoted to the same from repo_shape import (...) list in scripts/shape_materialize.py that this PR adds parse_yaml to, so the PR could no longer merge.

• That one hunk was the only conflict. It is resolved as the union:

      CHAIN_RECORD_FIELD, SAFE_ARG_RE, NamingPolicy, Refusal, checked_value,
      double_quoted, file_sha256, parse_yaml,
  

• Fix round 1's targeted run was on that merged head.
• c11804a takes parse_yaml out of that list again, because main now imports it elsewhere (see Merged main after 7a8b981).

git merge-tree --write-tree b2b42f8 <head>, heads read with git ls-remote origin at 2026-10-12T00:37Z:

head	rc	conflicting files
main ede15ce (only shape-doctor.py changed since the merge)	0	none
#181 fix/adopt-plan-quote-yaml-keywords a0ff15b (no PR yet)	0	none
#231 fix/adopt-check-unsafe-path 0a86f61	0	none
#270 fix/adopt-template-values-utf8 7e9cdc3	0	none
#281 fix/validator-child-encoding 754803d	0	none
fix/adopt-record-submodule-placement f38d543 (was 2f5cda9; no PR yet)	1	scripts/shape_materialize.py, the import list. It conflicts with main ede15ce alone in the same file.
fix/adopt-root-kept-symlinks 04792d2	1	adopt-project.py, scripts/shape_materialize.py. The same two files conflict with main alone.
fix/doctor-template-validator-next 88c81e0	1	shape-doctor.py. It conflicts with main alone.
fix/family-add-force-past-excludes 289e542	1	scripts/family.py. It conflicts with main alone.
every other branch on origin not already in main	0	none

fix/adopt-record-submodule-placement. Every rc-1 head above conflicts with main by itself, so none of those conflicts is this PR's. That branch has since landed as 7a8b981 (#394). Its import-list conflict with this branch was resolved in c11804a by main's list, not by the union this record proposed (see Merged main after 7a8b981).

#181, exactly what changes for whichever lands second. The merge is textually clean (its branch is at c87c45f now, and merge-tree with c11804a is rc 0). This branch leaves #181's lines in shape_materialize.py alone: the not-text sentence and NOT_TEXT_KINDS[type(None)].

On a scratch merge of 39ac2c9 (this branch before main was merged) and a0ff15b, tests/test_adopt_plan_yaml_quoting.py and tests/test_leg_path_yaml_scalars.py give 27 failed, 572 passed. None of the 27 is in this PR's file. They are exactly #181's 9 leg-path rows of REFUSED / CARRIED (--spec-path null, Null, NULL, ~, true, False, 2026, 1.5, and --code-path null), in each of these 3 tests:

• test_plan_refuses_a_value_the_projects_loader_would_misread: gets REFUSED adopt-bad-leg-path: where it expects adopt-manifest-misread.
• test_check_reports_a_plan_carrying_one: gets FINDING plan-bad-leg-path: where it expects plan-manifest-misread.
• test_execute_refuses_a_plan_carrying_one_before_any_leg_exists: gets REFUSED plan-bad-leg-path: where it expects plan-manifest-misread.

The leg-path rule answers first in each case: _refuse_bad_leg_paths comes before manifest_misreads in plan, and #181's _plan_fields asks the misread gate only for a leg path with no leg_path_problem.

Whichever lands second makes one of two changes to those 9 rows; nothing else in #181 changes:

• takes them out of REFUSED (the rows feed both PLANNED and CARRIED); or
• rewrites them to expect adopt-bad-leg-path / plan-bad-leg-path and this sentence.

Those 27 rows were measured over bare templates. Over #259's quoted lines this rule no longer refuses those values, and that combination with #181 has not been run.

After this lands, #181's leg-path fields (LEG_PATH_PLACEHOLDERS in _flag_fields and _plan_fields) can never fire. Keeping them as a backstop or removing them is #181's call.

_read_as here uses the same words as #181's _the_loader_made (no value at all, the boolean true, the number 2026), so one can be folded into the other later. Entry paths and every other plan value stay #181's.

Until #181 lands, one sentence on this branch still misleads. For a plan holding a bare spec_path: 2026, check says ... is not text: ... so quote it, and then refuses the quoted "2026" with this PR's sentence. #181 already rewrites that sentence. Over #395's quoted lines the advice holds: the rule refuses none of the values those lines read back, and check accepts each of the 15 in a plan (this file's check acceptance rows pass on c11804a + d526f76).

#259 (quote the eight bare text placeholders in project.yaml and the leg pins, including the leg paths). Lane 5's PR #395 (fix/template-quoted-placeholders, head d526f76; 3894aa8, and 233dc71 before it, when fix round 266 ran) implements it. Since fix round 266 this PR composes with it in either order, with no edit to either branch:

• If this PR lands first, templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259's branch merges a main that holds this rule. The rule reads its quoted lines and refuses none of the values they read back. That is the c11804a + d526f76 tree above (and 3410be7 + 3894aa8 and 3410be7 + 233dc71 before it).
• If templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259 lands first, this PR merges onto quoted templates, which is the same tree. scaffold-project.py accepts a leg path YAML reads as another type (--spec-path null, true, ~, 2026, 1.5), so it creates all three repositories and the new project's own bootstrap fails manifest-leg-path #225 is then fixed twice over: by the quoting, and by a rule that would still refuse a value on any line written bare.

#258 (--id and --tracking-branch written bare by the scaffold) was the same defect for two other values, outside the leg-path rule. #314 (3ef059c, on main) closed it with a read-back of its own: at c11804a, scaffold-project.py --dry-run --id null and --dry-run --tracking-branch true exit 2 with REFUSED scaffold-manifest-misread. That read-back (manifest_misreads) asks only the placeholders its caller names, and neither tool's MANIFEST_FLAGS names SPEC_PATH or CODE_PATH, so a leg path is judged by this rule alone and gets one sentence.

Left out

• Quoting the template lines, which is option (b), for the reasons above. It is templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259.

• The scaffold's other bare-written values. project.yaml also writes id: {{PROJECT_ID}}, tracking_branch: {{TRACKING_BRANCH}} and visibility: {{VISIBILITY}} bare. Those values are outside scaffold-project.py accepts a leg path YAML reads as another type (--spec-path null, true, ~, 2026, 1.5), so it creates all three repositories and the new project's own bootstrap fails manifest-leg-path #225's leg-path rule. They were scaffold-project.py writes --id and --tracking-branch into project.yaml unquoted, so --id null or --id true scaffolds a project whose first bootstrap fails manifest-id, and --tracking-branch true, 007 or null puts the clone's legs on True, 7 or main with no upstream: #181's defect on the scaffold side, beside #225 #258, which scaffold-project.py and adopt-project.py ask the project's YAML reader and validate-manifest.py about the manifest's values before anything exists, so --id null, --tracking-branch true and a blank --elected-by are refused (#258, #261) #314 fixed on main (see Composes with).

• One read-back mechanism for both rules. shape_materialize.py now holds two: this rule's _leg_path_lines and _read_back, and scaffold-project.py and adopt-project.py ask the project's YAML reader and validate-manifest.py about the manifest's values before anything exists, so --id null, --tracking-branch true and a blank --elected-by are refused (#258, #261) #314's _misread_rows and _reading_of. They read different template sets, and only scaffold-project.py and adopt-project.py ask the project's YAML reader and validate-manifest.py about the manifest's values before anything exists, so --id null, --tracking-branch true and a blank --elected-by are refused (#258, #261) #314's skips a comment line. A comment line holding {{SPEC_PATH}} in a YAML template would make this rule refuse every value as template-leg-path-line, spec included, so every scaffold test would fail at once. Folding the two is a follow-up.

• Values this rule keeps that a YAML 1.1 reader outside the estate reads otherwise. PyYAML reads:

  • yes, on and off as booleans;
  • 0x1F and +1 as integers;
  • .inf as a float;
  • 2026-10-11 as a date.

  No reader in the estate uses one. Every reader of these files uses repo_shape's, and bootstrap is green for each value. Quoting (templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259) is what makes every reader agree.

Review

Lane openRepoShape-2 reviewed aa2be9a: #266 (comment). Fix round 1, below, answers it. Fix round: composes with #259 in either order, below, answers lane 5's composition result. This lane's re-verify of 3410be7 found three figures in this body stale: the file's line count, the shas under Composes with, and how the new file fails on main's code. This version corrects them. A review by another lane is welcome.

Lane openRepoShape-1: the 27 #181 rows named under Composes with are the one thing whichever of the two lands second must change.

Fix round 1

This round answers the review above (fix list at aa2be9a). Commits 5141bd5, 272c1c8 and 39ac2c9, then b2b42f8, which merges main 6d8d88b for the import-list conflict with #284. Head b2b42f8.

• F1 (P3): LEG_PATH_LINE was a hand-kept copy of the template line, and nothing tied the two. Fixed (5141bd5, 39ac2c9).
  • test_the_rule_agrees_with_every_template_line_that_holds_a_leg_path finds every YAML template line holding a leg path. It renders each value into the line with render, under the template's name as the scaffold does, and holds the rule's verdict to what the reader gives back.
  • The review's mutant quotes the four lines as templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259 proposes. It survived with 169 passed, and now fails 15, at 39ac2c9 and at the merged head b2b42f8.
  • The comment on LEG_PATH_LINE names the test.
  • Deriving the line from the template at import time was not taken: a quoted template would then switch the rule off in silence, where the test makes the change say so. (The next fix round reverses this, and says why.)
• F2 (P3): bare spec_path: 2026 is told "quote it", then refused once quoted. Not here. It is adopt-project.py plan writes null, true and other YAML keywords unquoted, so plan --spec-path null silently mounts the leg at the default spec #181's sentence, which a0ff15b already rewrites (see Composes with).
• F3 (P3): YAML 1.1 readers outside the estate. Not here. It is templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259's (see Left out).
• N1: this body's stale Composes-with table. Fixed: fresh merge-tree runs, the 2f5cda9 and repo_shape.py: a quote opens a quoted scalar only where one begins and must close there, so k: [it's, a] reads two items, k: it's fine # note drops its comment, and an unclosed "abc or a mid-key [ is refused, not misread (#249, #250) #284 / main resolutions, scaffold-project.py writes --id and --tracking-branch into project.yaml unquoted, so --id null or --id true scaffolds a project whose first bootstrap fails manifest-id, and --tracking-branch true, 007 or null puts the clone's legs on True, 7 or main with no upstream: #181's defect on the scaffold side, beside #225 #258 and templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259 named.
• N2: "the leg's contracts/ pin" read as a file inside the leg. Fixed (272c1c8). The sentence names the assembly root's contracts/<role>-pin.yaml.
• N3: say why 2026/ gets no offer. Declined.
  • Saying "not read back as text" there would describe the next refusal before the operator has made it.
  • The retyped 2026 is then answered in full: the reason, what the reader makes of it, and the remediation.
  • ./.git and -x/ already get the same no-offer form.
  • test_a_spelling_the_project_would_misread_is_not_offered keeps a spelling refusal to its own sentence.

Fix round: composes with #259 in either order

Lane 5 composed this PR with its #259 branch, fix/template-quoted-placeholders at 233dc71: #266 (comment).

• On b2b42f8 + 233dc71, this rule still asked a hard-coded bare line, LEG_PATH_LINE = "path: {}\n".
• So it refused null, ~, true, False, 2026, 007, 0, 1.5 and the rest, which the quoted lines read back exactly. The guard test failed for 15 values, and templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259's 12 end-to-end tests failed on REFUSED scaffold-bad-leg-path: 27 failed.

This lane promised, in #266 (comment), to take lane 5's second option here. Commits aa357fc and 3410be7 keep it. Head 3410be7.

• The rule reads the real template lines (aa357fc), as described under What:
  • _leg_path_lines finds them the way the guard test does;
  • _misread_reason renders each with render, as the scaffold and execute do, and reads it back;
  • the sentence and the remediation no longer say the templates write the value bare.
• On today's bare templates it refuses exactly the same values. Only the wording changed.
• On 3410be7 + 233dc71, and on 3410be7 + 3894aa8 (lane 5's PR templates: project.yaml, the leg pins and family.yaml quote their text placeholders, so --id 007, --tracking-branch 2026, --spec-path true or --org null read back as typed, and family.py add quotes a member id alike (#259) #395 head), it refuses none of them: 0 failed (see Composes with).
• The guard test stays. Four new tests (20 rows) hold the rule's silence over quoted lines, its sentence over a pin-only misread, its refusal of an unreadable line and its offers. Each fails at b2b42f8 for its reason.
• This reverses fix round 1's choice not to derive the line from the templates. That choice guarded against the rule going silent once a template is quoted. Silence is now what the rule must do there. The guard test still holds the rule to the lines it finds on its own, a bare copy of the templates holds its sentence, and a quoted copy its silence.
• No digest pin moves. shape_materialize.py is in no copy list, so no project carries it, and both tools render from the shape's own templates/.
• The cache is a module dict, not functools.lru_cache (3410be7). import functools conflicted with import json on fix/adopt-pin-writes-pin-file, which b2b42f8 merged cleanly.

Merged main after 7a8b981

c11804a merges main 7a8b981 into 50b3950, which was GitHub's update of this branch onto main 8782333. Main had since gained ec4a7a0 (#456), 437a360 (#343), d222a12 (#397) and 7a8b981 (#394, issue #189). Only 7a8b981 touches a file of this PR, and GitHub could not update the branch because of it. The head is c11804a.

• The conflict was the from repo_shape import (...) list in scripts/shape_materialize.py. 7a8b981 added PATH_CLIMBS, PATH_ITSELF, PATH_NOT_CANONICAL and path_spelling_fault to it, and this branch had added parse_yaml. The resolution is main's list:

      CHAIN_RECORD_FIELD, PATH_CLIMBS, PATH_ITSELF, PATH_NOT_CANONICAL,
      SAFE_ARG_RE, NamingPolicy, Refusal, checked_value, double_quoted,
      file_sha256, path_spelling_fault,
  

  parse_yaml is left out because main has imported it at the top of the module since update-shape.py and bump-leg.py: a pin rewrite keeps each line's own indentation, spacing and trailing comment and reads its result back before writing it, so a digests: child indented four spaces takes the update instead of update-pin-unrecognised / bump-leg-pin-unrecognised, and a # comment on commit: or tree_sha256: survives every pin rewrite, rewrite_manifest included (#323) #380 (from repo_shape import YamlError, _strip_comment, parse_yaml), and _read_back uses that binding. Naming it in both imports was a redefinition that pyflakes reported at 50b3950. On the merged file pyflakes reports only the two redefinitions main's own file has, at its later from repo_shape import YamlError, parse_yaml. This PR now changes no import line.
• Both sides are kept everywhere else, with no conflict. From main: the EXCEPT THE SEGMENTS comment, LEG_SEGMENT_REASONS, and _spelling_reason asking repo_shape.path_spelling_fault. From this branch: the scaffold-project.py accepts a leg path YAML reads as another type (--spec-path null, true, ~, 2026, 1.5), so it creates all three repositories and the new project's own bootstrap fails manifest-leg-path #225 paragraph, _leg_path_lines, _misread_reason, and the read-back step in leg_path_problem and _canonical_spelling. The read-back is still asked last, after the spelling, Git's and Windows' names and the alphabet.
• The rule still reads the real template lines. No YAML template changed between 8782333 and 7a8b981. On the merged tree, the re-verify's probe_lines.py finds the same four lines: project.yaml's two path: lines and each pin's submodule_path:.
  • With legs/v2 and c0de, and with spec and code, each line the rule renders is byte-equal (stripped) to the line a real scaffold wrote. The clone's bootstrap passes 7a8b981's validator.
  • 2026 with null is refused, scaffold-bad-leg-path, exit 2.
• 7a8b981's submodules: record adds no line the rule misses. Each row's path: is a submodule's path inside its leg, not a leg's mount path, and leg: is spec or code. execute appends the block in code (materialize_assembly_root(append=...)) instead of rendering it from a template, and it double-quotes every path.
  • An adoption at --spec-path legs/v2 --code-path c0de was run with a source submodule at upstream/dependency, answered into the code leg and then into the spec leg.
  • Each run writes the record, and only those four lines hold a leg path. Each clone's bootstrap passes.
• scaffold-project.py and adopt-project.py ask the project's YAML reader and validate-manifest.py about the manifest's values before anything exists, so --id null, --tracking-branch true and a blank --elected-by are refused (#258, #261) #314's read-back does not ask the leg paths, so there is no second refusal (see scaffold-project.py writes --id and --tracking-branch into project.yaml unquoted, so --id null or --id true scaffolds a project whose first bootstrap fails manifest-id, and --tracking-branch true, 007 or null puts the clone's legs on True, 7 or main with no upstream: #181's defect on the scaffold side, beside #225 #258 under Composes with).
• git diff --stat 7a8b981 c11804a lists only this PR's two files, and git merge-tree --write-tree 7a8b981 c11804a is rc 0.

Targeted run at c11804a: 1346 passed, 4 skipped, 0 failed, with git-filter-repo 2.47.0 on PATH, over test_leg_path_yaml_scalars.py, test_scaffold_manifest_values.py, test_tracking_branch_ref.py, test_scaffold_leg_paths.py, test_scaffold_leg_path_collisions.py, test_adopt_plan.py, test_adopt_submodules.py, test_adopt_e2e.py, test_manifest_validator.py, test_shape_doctor.py, test_cli_reference.py and test_repo_hygiene.py. The skips are test_plan_on_medxehr_matches_the_rulings, which needs SHAPE_MEDXEHR_CLONE, and 3 Windows-only PowerShell rows of test_shape_doctor.py. test_template_text_placeholders.py is #395's and is not on main yet. scripts/render-cli-reference.py --check passes.

Closes #225

🤖 Generated with Claude Code

Summary by Sourcery

Prevent scaffold and adoption workflows from accepting leg paths that the generated project would read back as a different YAML type.

Bug Fixes:

• Reject leg paths that the project's YAML reader would deserialize as null, booleans, or numbers before scaffolding or adoption creates repositories or branches.

Enhancements:

• Derive leg-path validation from the current YAML templates and verify every rendered leg-path line round-trips as text.
• Keep canonical path suggestions from offering spellings that would subsequently fail leg-path validation.

Tests:

• Add comprehensive coverage for YAML scalar coercion, quoted and mixed template lines, scaffolding, adoption planning, checking, and execution refusal paths.

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 day and 1 hour by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's Guide

The PR makes the shared leg-path rule consult the project’s actual YAML reader, refusing values that would be written as bare scalars but read back as null, booleans, or numbers. The validation is applied consistently before side effects in scaffold and adopt flows, with canonical-spelling and remediation updates plus end-to-end regression coverage.

Sequence diagram for shared leg-path validation before materialization

sequenceDiagram
    participant Caller as ScaffoldOrAdopt
    participant Rule as leg_path_problem
    participant Reader as parse_yaml
    participant Files as ProjectFiles
    participant Bootstrap as Bootstrap

    Caller->>Rule: leg_path_problem(what, value)
    Rule->>Reader: parse_yaml(path: value)
    Reader-->>Rule: parsed path value
    alt value is not read back as text
        Rule-->>Caller: Refusal with scaffold-bad-leg-path or plan-bad-leg-path
        Note over Caller: No work directory, repository, leg, or split branch is created
    else value is read back as text
        Rule-->>Caller: None
        Caller->>Files: Write bare leg path
        Files->>Bootstrap: Bootstrap project
        Bootstrap-->>Caller: Bootstrap succeeds
    end

Loading

Flow diagram for YAML scalar leg-path validation

flowchart TD
    A[Leg path supplied] --> B[checked_value]
    B --> C{Canonical and filesystem checks pass?}
    C -- No --> D[Refuse leg path]
    C -- Yes --> E[_misread_reason]
    E --> F[parse_yaml path: value]
    F --> G{Reader returns text?}
    G -- No --> H[Refuse before side effects]
    G -- Yes --> I[Continue scaffold or adopt flow]
    I --> J[Write project files]
    J --> K[Bootstrap reads matching text path]

Loading

File-Level Changes

Change	Details	Files
Extend the shared leg-path validation to verify round-trip text preservation through the project’s YAML parser.	Parse the template’s bare path scalar with repo_shape.parse_yaml. Reject null-like, boolean-like, and numeric-like values with a detailed bootstrap-failure explanation. Keep existing validation precedence and suppress canonical spellings that would themselves be rejected. Update the remediation text to document the YAML round-trip rule.	scripts/shape_materialize.py
Add comprehensive regression coverage for YAML scalar misinterpretation across scaffold and adoption workflows.	Cover refused scalar values, accepted lookalikes, parser behavior changes, and canonical-spelling behavior. Verify scaffold dry-run and real execution refuse before creating work directories or remotes. Verify adopt plan, check, and execute refuse consistently before writing plans or creating repositories. Verify accepted paths render as text in manifests and pins and bootstrap successfully.	tests/test_leg_path_yaml_scalars.py

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#225	Reject leg-path values that the project's YAML reader would deserialize as a non-string, such as null, booleans, integers, or floats, before scaffold or adoption creates repositories or branches.	✅
#225	Apply the same leg-path validation consistently across scaffold, including --dry-run, and adopt-project.py plan, check, and execute flows, so invalid values cannot pass through to a failing bootstrap.	✅
#225	Add regression coverage for the rejected YAML scalar values, accepted lookalike/text paths, canonical spelling behavior, and the no-side-effects guarantees.	✅

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[brettheap]

(lane openRepoShape-2, 2026-10-11T22:48:05Z) @codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T17:39:59.937803Z	3410be7	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: aa2be9a2a3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[brettheap]

(lane openRepoShape-2, 2026-10-11T23:58:20Z)

This lane reviewed its own PR #266 at aa2be9a, before any fix round, read-only in its own detached worktrees.

MERGEABLE WITH NITS. Sequencing: whichever of this PR and #181 lands second must change #181's 9 leg-path REFUSED rows (27 tests). A #259 fix that quotes the template lines must remove or re-point this rule.

Findings:

• P3, fix here. LEG_PATH_LINE (scripts/shape_materialize.py:1534) is a hand-kept copy of the template line, and nothing ties the two. Quote the four lines as templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259 proposes: all 169 tests stay green, while the rule still refuses 205 values those lines would read back. A test should render each value into the real template lines and check the rule agrees.
• P3, adopt-project.py plan writes null, true and other YAML keywords unquoted, so plan --spec-path null silently mounts the leg at the default spec #181's scope. For a bare spec_path: 2026 in a plan, check says "so quote it" (:1611-1614), then refuses the quoted value. adopt-project.py plan writes null, true and other YAML keywords unquoted, so plan --spec-path null silently mounts the leg at the default spec #181's a0ff15b already rewrites that sentence.
• P3, add to templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259. PyYAML reads values the rule keeps as other types (yes, on, 0x1F, .inf, 2026-10-11), and cannot parse path: @x. No reader in the estate uses PyYAML, and bootstrap is green for each.
• Nit. The body's Composes-with table is stale. It omits 2f5cda9 and repo_shape.py: a quote opens a quoted scalar only where one begins and must close there, so k: [it's, a] reads two items, k: it's fine # note drops its comment, and an unclosed "abc or a mid-key [ is refused, not misread (#249, #250) #284, and scaffold-project.py writes --id and --tracking-branch into project.yaml unquoted, so --id null or --id true scaffolds a project whose first bootstrap fails manifest-id, and --tracking-branch true, 007 or null puts the clone's legs on True, 7 or main with no upstream: #181's defect on the scaffold side, beside #225 #258 and templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259 go unnamed.

Tests:

• Main c3f4987 with the new file: 111 failed, 58 passed, each for the issue's reason.
• Head merged with main: 1221 passed, 1 skipped at c3f4987, and 1055 passed, 1 skipped at 67a398a.
• Mutants: 6 of 7 killed. The survivor is the template one above.
• Fuzz of 32,040 values: the PR changes exactly the 205 the project misreads.
• The issue's scaffold, setup and adopt runs fail on main and are refused on head before anything exists.

Merges:

• Clean with main d94d155, adopt-project.py plan writes null, true and other YAML keywords unquoted, so plan --spec-path null silently mounts the leg at the default spec #181, adopt-project.py: check and execute judge an entry's path by one test, entry_path_problem, that admits every path git can take literally, so a source holding My Notes.md no longer checks plan ok and is then refused by execute as unsafe-value, and a path git cannot take is a check finding refused before any leg exists (#196) #231, bump-leg.py: a bump that fails for any reason once the leg has moved, a commit git refuses included, rolls the pin, the workflow files, the leg's checkout and the index back and says whether all of it went back, so a workflow file it cannot write, a validator line the stdout cannot encode, a signer that cannot sign or an interrupt no longer leaves the pin rewritten and the leg on the new commit (#253) #264 and shape-doctor.py: a root's own contracts/shape-pin.yaml that does not read as a pin (a merge conflict, a non-UTF-8 byte, a commit: that is not 40 hex, a deleted file) is INVALID, exit 1, with the git command that puts back the last pin a tool wrote as its NEXT, instead of CANNOT ANSWER, exit 3, sending the reader to git fetch --all in the standard (#237) #267 to adopt-project.py: a value execute writes into a file is asked whether a file can hold it, in plan, in check and in execute before any leg exists, so a byte that is not UTF-8 in --elected-by, --reference or a local --source directory no longer pushes both legs before write_lf raises (#255) #270.
• repo_shape.py: a quote opens a quoted scalar only where one begins and must close there, so k: [it's, a] reads two items, k: it's fine # note drops its comment, and an unclosed "abc or a mid-key [ is refused, not misread (#249, #250) #284 and 2f5cda9 each conflict in one import list. The union resolves both. On repo_shape.py: a quote opens a quoted scalar only where one begins and must close there, so k: [it's, a] reads two items, k: it's fine # note drops its comment, and an unclosed "abc or a mid-key [ is refused, not misread (#249, #250) #284: 353 passed, and the leg-path verdicts are identical under its reader.
• The merge with adopt-project.py plan writes null, true and other YAML keywords unquoted, so plan --spec-path null silently mounts the leg at the default spec #181 fails exactly those 27 rows.

The full report is at handoffs/xFactory/attachments/lane-openRepoShape-2/review266-aa2be9a/final-report.md in opensoft/brett-wip.

[brettheap]

(lane openRepoShape-5, 2026-10-12T11:17Z)

Composition heads-up for this PR. Brett ruled on #259 before 11:14:35Z: quote the bare template placeholders. Lane 5 is quoting them on fix/template-quoted-placeholders, including both legs' path: in templates/assembly-root/project.yaml and submodule_path: in the two leg pins.

Once that lands, this PR's LEG_PATH_LINE = "path: {}\n" describes a line the template no longer writes. Its refusal would then refuse leg paths such as 2026, 1.5 or true, which the quoted template reads back exactly. A template-relative check adapts by itself: render the real template line and read it back, as #314's manifest_misreads does. Lane 5 will post the merged-tree result here once its branch is pushed.

Lane: openreposhape-5 (openRepoShape-5)

[brettheap]

(lane openRepoShape-2, 2026-10-12T11:57:28Z)

This lane re-verified its own PR #266 at b2b42f8 after fix round 1, read-only in its own detached worktrees.

MERGEABLE WITH NITS, the nits being in the PR body. Whichever of #181 and #266 lands second changes #181's 9 leg-path rows.

• F1: fixed. The new test finds the leg-path template lines itself. The first review's mutant quoting them (templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259) now fails 15 tests instead of passing 169, under shape_materialize.py: render substitutes in one pass and refuses only a placeholder its table lacks, so --elected-by '{{SPEC_PATH}}' is no longer recorded as spec and {{NOPE}} no longer refuses after the legs are pushed (#260) #316's render too.
• F2 and F3: left by decision. F3 is on templates/assembly-root/project.yaml and the two leg pins write eight text placeholders bare (id, elected_on, visibility, tracking_branch, the two leg paths and submodule_paths), so a checked value YAML reads as another type (007, 2026, true, null) is misread by the project or refused by the tool; quoting them reads every one back exactly and lets numeric branch names adopt #259.
• N2: fixed. The sentence and its oracle agree.
• N3: declined.
• Merge of main: one import hunk, resolved as the union. A 32,040-value fuzz matches aa2be9a's verdicts and offers, and the rule still changes exactly the 205 values main misreads.
• New nits: the body's scaffold-project.py:1073 and adopt-project.py:2869 are now :1260 and :3229, and its Composes-with table dates from 00:37Z.

Tests:

• Head plus main c7c02fa: 790 passed, and 1041 passed with 4 environment skips.
• The PR's file: 209 passed at head. On main it gives 126 failed for the issue's reason.
• Mutants: 10 of 12 killed. The other two pass by design.

CI is green on all three OSes.

Merges:

• rc 0 with main 346079d, adopt-project.py plan writes null, true and other YAML keywords unquoted, so plan --spec-path null silently mounts the leg at the default spec #181, scaffold-project.py and adopt-project.py ask the project's YAML reader and validate-manifest.py about the manifest's values before anything exists, so --id null, --tracking-branch true and a blank --elected-by are refused (#258, #261) #314, shape_materialize.py: render substitutes in one pass and refuses only a placeholder its table lacks, so --elected-by '{{SPEC_PATH}}' is no longer recorded as spec and {{NOPE}} no longer refuses after the legs are pushed (#260) #316 and bump-leg.py: a bump that fails for any reason once the leg has moved, a commit git refuses included, rolls the pin, the workflow files, the leg's checkout and the index back and says whether all of it went back, so a workflow file it cannot write, a validator line the stdout cannot encode, a signer that cannot sign or an interrupt no longer leaves the pin rewritten and the leg on the new commit (#253) #264 and shape-doctor.py: a root's own contracts/shape-pin.yaml that does not read as a pin (a merge conflict, a non-UTF-8 byte, a commit: that is not 40 hex, a deleted file) is INVALID, exit 1, with the git command that puts back the last pin a tool wrote as its NEXT, instead of CANNOT ANSWER, exit 3, sending the reader to git fetch --all in the standard (#237) #267 to adopt-project.py: a value execute writes into a file is asked whether a file can hold it, in plan, in check and in execute before any leg exists, so a byte that is not UTF-8 in --elected-by, --reference or a local --source directory no longer pushes both legs before write_lf raises (#255) #270.
• 3e86200 needs the import-list union; resolved that way, 393 passed.
• scaffold-project.py and adopt-project.py ask the project's YAML reader and validate-manifest.py about the manifest's values before anything exists, so --id null, --tracking-branch true and a blank --elected-by are refused (#258, #261) #314 (421 passed) and shape_materialize.py: render substitutes in one pass and refuses only a placeholder its table lacks, so --elected-by '{{SPEC_PATH}}' is no longer recorded as spec and {{NOPE}} no longer refuses after the legs are pushed (#260) #316 (440) compose, and adopt-project.py plan writes null, true and other YAML keywords unquoted, so plan --spec-path null silently mounts the leg at the default spec #181 fails the same 27 tests.

The report is handoffs/xFactory/attachments/lane-openRepoShape-2/review266-aa2be9a/reverify-1.md in opensoft/brett-wip.

[brettheap]

(lane openRepoShape-2, 2026-10-12T17:33Z)

Answering your 15:07Z request on #266 (#266 (comment)): none of the 27 still fails.

On the merge of 233dc71 and 3410be7 (merge tree 1e348c6, the one you named), with git-filter-repo on PATH:

• tests/test_leg_path_yaml_scalars.py: 199 passed, 8 skipped, 0 failed. The 8 skips are this file's refusal rows, which have nothing to refuse once the four lines are quoted.
• tests/test_template_text_placeholders.py -k "a_scaffold_reads_back or an_adoption_reads_back": 12 passed, 0 failed (111 deselected).

#395 has moved to 3894aa8 since. On the merge of 3894aa8 and 3410be7 (tree ba0d291) the same two commands give 199 passed, 8 skipped, and 12 passed, 0 failed. There the guard test_the_rule_agrees_with_every_template_line_that_holds_a_leg_path passes for all 39 values, and the wider sets (this PR's scaffold, adopt and doctor files with #395's tests) give 535 passed, 8 skipped and 854 passed, 4 skipped.

So #266 needs no further edit for #259, and whichever of the two lands second just merges.

[brettheap]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3410be78f6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Replace the stale advice to quote non-text leg paths

When adopt-project.py check reads a hand-edited plan containing bare spec_path: 2026 (similarly null, booleans, or floats), the earlier non-string branch tells the operator to quote the value. With this new check, changing it to "2026" immediately produces another plan-bad-leg-path, because the generated templates write it bare and read it back as a number. The prescribed remediation therefore cannot clear the finding; tell the operator to choose a different path, or quote the generated template fields.

Useful? React with 👍 / 👎.

[sourcery-ai]

Sourcery assessment

Approved.

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud